以網路流量資料探勘進行阻斷服務攻擊偵測之研究

Mining Network Traffic Data for Supporting Denial of Service Attack Detection

蕭漢威(Han-Wei Hsiao) ； 楊錦生(Chin-Sheng Yang) ； 魏志平(Chih-Ping Wei) ； 馬淑貞(Shu-Chen Ma)

《資訊管理學報》 14卷2期 (2007/04) Pp. 1-25

https://doi.org/10.6382/JIM.200704.0001

摘要

隨著網際網路與電子商務的蓬勃發展，網路安全的議題日趨重要，在眾多網路安全事件中，阻斷服務攻擊(Denial of Service)為近年來造成網路傷害的主要原因之一。阻斷服務攻擊主要是由攻擊者對特定目標傳送大量封包來進行攻擊，使得被攻擊者無法提供服務給正常的使用者，其影響範圍除造成正常使用者無法使用網路服務外，更可能造成進一步的商業損失。在這樣的環境下，如何有效的偵測出阻斷服務攻擊事件，並進行適當的防禦，對於網路管理人員而言是一項迫切且必須的工作。阻斷服務攻擊經常會使用IP Spoof的技術，以偽造的來源IP來進行攻擊，使得網路管理者無法輕易的找出攻擊來源，並使以網路第三層資訊為塞礎的入侵偵測系統無法有效進行防禦。為能有效地偵測網路中的阻斷服務攻擊事件，並克服IP Spoof可能造成的偵測困難，本研究以網路設備的SNMP流量為塞礎，運用資料探勘中的分類分析技術，提出了一個阻斷服務攻擊偵測及防禦系統，並以實際企業網路和學校宿舍網路來評估系統的偵測效能。評估結果顯示，本研究所提偵測系統可以達到相當好的預測準確率，在企業和學校宿舍網路環境下，其準確率分別可達到99.78%與98.59%以上，且遺漏率與誤報率也控制在相當低的程度。

關鍵字

網路安全 ； 阻斷服務攻擊 ； 攻擊偵測 ； 資料探勘

並列摘要

With the advances in networking technologies, organizations have increasingly participated in or shifted to the Internet environment to conduct business transactions. According to prior research on E-business, network security is one of the key factors for E-business success. Denial of service (DoS) attack, which aims at rendering a computer or network incapable of providing normal services, is a major cause of current network insecurity. Existing DoS attack defense mechanisms (e.g., firewalls and intrusion detection systems) typically rely on packet information gathered from gateways of network systems. Because such packet information is on the IP-layer or above, existing defense mechanisms are incapable of detecting internal attacks or attackers who disguise themselves by spoofing source IP addresses. To address the aforementioned limitations of existing DoS attack defense mechanisms, we propose a classification-based DoS attack detection technique to induce a DoS detection model on the basis of the SNMP data. The constructed DoS detection model is then used for predicting whether a network traffic flowing through a network interface is a DoS attack. To empirically evaluate our proposed classification-based DoS attack detection technique, we collect network traffic data from two different environments, including an enterprise network and a university campus network. Our empirical evaluation results show that the detection accuracy of the proposed technique reaches 99.78% and 98.59% or above in both network environments respectively.

並列關鍵字

Network Security ； Denial of Service DoS ； Attack Detection ； Data Mining

參考文獻

Barford, P.,Kline, J.,Plonka, D.,Ron, A.(2002).A Signal Analysis of Network Traffic Anomalies.Proceedings of the 2nd ACM SIGCOMM Workshop on Internet Measurement.71-82.

Kargl, F.,Marier, J.,Schlott, S.,Weber, M.(2001).Protecting Web Servers from Distributed Denial of Service Attacks.Proceedings of the International WWL Conference (WWW10).

Kim, J.,Lee, J.,Han, K.,Lee, M.(2002).Business as Buildings: Metrics for the Architectural Quality of Internet Businesses.Information Systems Research.239-254.

Lawrence, A. G.,Martin, P. L.,William, L.,Robert, R.(2004).2004 CSI/FBI Computer Crime and Security Survey.

Essential of SNMP